Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

InvoicePlane

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE).

CVE-2025-67084 is a critical vulnerability affecting InvoicePlane, an open-source invoicing and billing software, specifically versions through 1.6.3. The flaw lies in the file upload functionality for attachments, where authenticated users can upload arbitrary PHP files without sufficient validation or sanitization. This allows attackers to place malicious PHP scripts on the server, which can be executed remotely to gain full control over the affected system. The vulnerability is classified under CWE-616 (Improper Restriction of a File Upload to a Specific Type) and has a CVSS v3.1 base score of 9.9, reflecting its high impact and ease of exploitation. The attack vector is network-based, requiring low attack complexity and only authenticated privileges, with no user interaction needed. The scope is changed, meaning the vulnerability can affect components beyond the initially compromised system, potentially allowing attackers to pivot within the network. Although no public exploits have been reported yet, the critical nature of this vulnerability and the widespread use of InvoicePlane in small and medium enterprises (SMEs) make it a significant threat. The lack of an official patch at the time of disclosure necessitates immediate mitigation through configuration and monitoring. This vulnerability can lead to complete compromise of the invoicing server, exposing sensitive financial data and enabling further attacks on the internal network.

Detailed information about CVE-2025-67084: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-67084: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-67084: n/a

Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server. The ability to read files and the file type depends on the web server and its configuration.

CVE-2025-67083 identifies a directory traversal vulnerability in InvoicePlane, an open-source invoicing application, affecting versions through 1.6.3. This vulnerability allows unauthenticated attackers to manipulate file path inputs to access files outside the intended directories on the server hosting InvoicePlane. The vulnerability arises from insufficient validation or sanitization of user-supplied input used in file path resolution, enabling traversal sequences such as '../' to access arbitrary files. The specific files accessible depend on the underlying web server configuration, including root directories and file permissions. Because no authentication is required, any remote attacker can attempt to exploit this flaw to read sensitive files such as configuration files containing database credentials, environment variables, or other private data. The vulnerability does not require user interaction and can be exploited remotely, increasing its risk profile. No CVSS score has been assigned yet, and no public exploits have been reported, but the potential for information disclosure is significant. The lack of available patches at the time of publication requires organizations to implement interim mitigations such as web server hardening and access restrictions. This vulnerability could serve as a stepping stone for further attacks if sensitive credentials or keys are exposed, potentially leading to broader compromise of affected systems.

Detailed information about CVE-2025-67083: n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2025-67083: n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-67083: n/a

An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An authenticated attacker can exploit this issue via error-based SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing of single quotes.

CVE-2025-67082 identifies a critical SQL injection vulnerability in the InvoicePlane invoicing application, specifically affecting versions through 1.6.3. The vulnerability exists in the handling of 'maxQuantity' and 'minQuantity' parameters used during report generation. These parameters are not properly sanitized, particularly failing to escape or handle single quotes, which enables an authenticated attacker to inject malicious SQL code. The injection is error-based, meaning attackers can leverage database error messages to infer and extract arbitrary data from the backend database. This type of vulnerability compromises the confidentiality and integrity of the stored data, potentially exposing sensitive financial and client information. Exploitation requires the attacker to be authenticated, which limits the attack surface to users with some level of access but does not require administrative privileges. No public exploits have been reported yet, and no official patch links are provided, indicating that organizations must monitor for vendor updates or implement workarounds. The lack of a CVSS score necessitates an independent severity assessment based on impact and exploitability factors. The vulnerability arises from insufficient input validation and lack of parameterized queries in the affected code paths. This flaw could be leveraged in targeted attacks to extract sensitive business data or escalate privileges if combined with other vulnerabilities.

Detailed information about CVE-2025-67082: n/a. Get real-time updates, technical details, and mitigation strategies.


CVE-2025-67084: n/aCVE-2025-67084 0 File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files into attachments, which can later be executed remotely, leading to Remote Code Execution (RCE). CriticalVulnerabilityGermanyFranceItaly+5#cve #cve-2025-67084 Join the discussion	CVE Database V5	01/15/2026, 00:00:00 UTC Added: 01/15/2026, 15:18:14 UTC
CVE-2025-67083: n/aCVE-2025-67083 0 Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the server. The ability to read files and the file type depends on the web server and its configuration. MediumVulnerabilityGermanyUnited KingdomFrance+5#cve #cve-2025-67083 Join the discussion	CVE Database V5	01/15/2026, 00:00:00 UTC Added: 01/15/2026, 15:18:14 UTC
CVE-2025-67082: n/aCVE-2025-67082 0 An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" parameters when generating a report. An authenticated attacker can exploit this issue via error-based SQL injection, allowing for the extraction of arbitrary data from the database. The vulnerability arises from insufficient sanitizing of single quotes. MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve #cve-2025-67082 Join the discussion	CVE Database V5	01/15/2026, 00:00:00 UTC Added: 01/15/2026, 15:18:14 UTC

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional